Patch "nfsd: fix possible badness in FREE_STATEID" has been added to the 6.11-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    nfsd: fix possible badness in FREE_STATEID

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nfsd-fix-possible-badness-in-free_stateid.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3d86b3c6c500ddff93b85653e2df8f01707c13a2
Author: Olga Kornievskaia <okorniev@xxxxxxxxxx>
Date:   Fri Oct 4 18:04:03 2024 -0400

    nfsd: fix possible badness in FREE_STATEID
    
    [ Upstream commit c88c150a467fcb670a1608e2272beeee3e86df6e ]
    
    When multiple FREE_STATEIDs are sent for the same delegation stateid,
    it can lead to a possible either use-after-free or counter refcount
    underflow errors.
    
    In nfsd4_free_stateid() under the client lock we find a delegation
    stateid, however the code drops the lock before calling nfs4_put_stid(),
    that allows another FREE_STATE to find the stateid again. The first one
    will proceed to then free the stateid which leads to either
    use-after-free or decrementing already zeroed counter.
    
    Fixes: 3f29cc82a84c ("nfsd: split sc_status out of sc_type")
    Signed-off-by: Olga Kornievskaia <okorniev@xxxxxxxxxx>
    Reviewed-by: Benjamin Coddington <bcodding@xxxxxxxxxx>
    Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3837f4e417247..64cf5d7b7a4e2 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7158,6 +7158,7 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 	switch (s->sc_type) {
 	case SC_TYPE_DELEG:
 		if (s->sc_status & SC_STATUS_REVOKED) {
+			s->sc_status |= SC_STATUS_CLOSED;
 			spin_unlock(&s->sc_lock);
 			dp = delegstateid(s);
 			list_del_init(&dp->dl_recall_lru);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux